933d67578993653c18443cacde7f3eff2fad96c84f8071ce5b05292ee5c425b6

General

Target
933d67578993653c18443cacde7f3eff2fad96c84f8071ce5b05292ee5c425b6
Size 6.3MB
Sample260728-jqa17aga96
SHA256 933d67578993653c18443cacde7f3eff2fad96c84f8071ce5b05292ee5c425b6
MD5 b9269f808378abb0715730272b05689a
SHA1 b5b311bb34f99c4f5ac2e34058f0854b2c2b08d0
SHA512 6d4465f94b3ee7d3c1f128d09766e16e6af6371c98e95adaccf6bd7139f64e7443085c6c0c23a7b52e2c524d88e330cfb6696d5512df442dd0ab692416eef30f
SSDEEP 98304:/VOCOTbHajiwwo3tIVHZCTcfgvC2ed6wn9wHelYtvT1xGd/+uCKbIdoWhNNmkDO8:IzHMi1o9Ipx4o9wHKaTQMNMktC/8
TLSH
T12966330A4E22D607B3EBD7830432C76D842E48F974D3A7D2324D6997EC7F34169629B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n011.msi
- Size 6.5MB
- SHA256 f6d97d72614a4de4086c4d16b2fba82c469697fc68cfed9875888a61fd887a81
- MD5 2773e87da072aa2b5d550e98bb588a40
- SHA1 ebb06ac4479bd468774f56e34ca8e123fed9f0a6
- SHA512 c4932570ac6245786497cad736198eead1ef1db1d0776cd4b72a5b21f72e185f2b0ccaed64a4f9a1df5ac773ed2b570d16f6124f03bee32bf4b1ffb0af19a6ab
- SSDEEP 98304:gTSYzK75bMDE2smbDIJHFWbIX4fsqaXSGVUCkXlsgGvxzjTjOKCYfqdYWrn36czH:gXY5bSErmfIFPoasXqxLmnqcTCdm
- TLSH
  T1B76633867CCA5331E0DBC7B2402361AEB12E7FC9BEA38C473ADD7A859D723015176295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2